Confirmed malicious npm packages
Every package version with a published advisory, newest first. 3,621 in total. Each links to the full advisory, with the analysis behind the verdict and its MITRE ATT&CK classification. An advisory is published only once a verdict has a written analysis, so this index is smaller than the confirmed-malware count on the live page. Page 10 of 37.
- delivery-ci-dpat@35.1.5 LWA-2026-10684T1059T1105T1071.001T1102T1059.007
- devplatform-api-v1-resources@35.4.7 LWA-2026-10681T1059.007T1105T1071.001T1071.004T1102
- devplatform-eslint-config@35.8.9 LWA-2026-10680T1059.007T1105T1071.001T1102T1082
- delivery-ci-jira-rnd@35.5.4 LWA-2026-10682T1059.007T1105T1071.001T1071.004T1059
- devplatform-stylelint-config@35.7.4 LWA-2026-10676T1059T1059.007T1105T1071.001T1102
- devplatform-spa-plugin-remote-module@35.9.6 LWA-2026-10677T1059.007T1105T1071.001T1102T1059
- devplatform-spa-plugin-feature-toggle@35.7.4 LWA-2026-10678T1059.007T1105T1071.001T1102T1059
- devplatform-spa-errors@35.5.7 LWA-2026-10679T1059T1059.007T1105T1071.001T1102
- bigops-abstract-entity-data@35.1.7 LWA-2026-10673T1105T1059T1071.001T1102T1082
- dolyame-boxy-independent-bnpl-product-grid@35.9.2 LWA-2026-10674T1105T1059.007T1059.003T1071.001T1102
- dolyame-boxy-atom-bnpl-navigation-arrow@35.6.5 LWA-2026-10675T1059.007T1105T1071.001T1102T1082
- bigops-shared-product-design@35.9.3 LWA-2026-10672T1059.007T1105T1071.001T1102T1059
- @vertexa/prisma-engines@7.8.1 LWA-2026-10669T1195.002T1059.007T1105
- format-helper-lib@1.0.0 LWA-2026-10668T1059.007T1082T1613T1046
- khanbmnxls@1.0.0 LWA-2026-10667T1071.001T1567T1027T1059.007
- @sqlite-prime/nodesql@1.0.4 LWA-2026-10666T1195.002T1059.007
- internallib_v514@1.0.1 LWA-2026-10662T1059.007T1105T1071
- weight2loss@1.0.5 LWA-2026-10661T1059.007T1552.001T1082T1071.001T1105
- nice-utils-helper@1.0.0 LWA-2026-10656T1526T1082
- merge-grid-stats@1.0.0 LWA-2026-10655T1059.007T1082T1071.001
- gpt-terminal-cli@1.0.0 LWA-2026-10654T1195.002T1059.007T1059T1547.001T1547.004
- dojo-rn-interview@1.0.1 LWA-2026-10653T1059.007T1082T1005T1041T1071.001
- wormgpt-cli@1.0.1 LWA-2026-10651T1059.007T1059.001T1547.001T1547.004T1547.006
- mx-www-locales-common@99.0.0 LWA-2026-10650T1059.007T1082T1071.001T1041
- express-chai@3.7.9 LWA-2026-10649T1195.002T1059.007T1105T1071.001
- @vault-v2-reallocation-bot/config@0.0.1 LWA-2026-10646T1195.002
- @vault-v2-reallocation-bot/client@0.0.1 LWA-2026-10645T1195.002T1105
- @morpho-blue-liquidation-bot/data-providers@2.0.0 LWA-2026-10640T1195.002T1195
- @morpho-blue-liquidation-bot/liquidity-venues@2.0.0 LWA-2026-10641T1195.002T1105
- @pump-fun-skills/coin-fees@1.0.0 LWA-2026-10644T1195.002
- @morpho-blue-liquidation-bot/pricers@2.0.0 LWA-2026-10642T1195.002T1195
- @morpho-blue-liquidation-bot/config@2.0.0 LWA-2026-10639T1195.002T1105T1059.007
- @morpho-blue-reallocation-bot/client@2.0.0 LWA-2026-10643T1195.002T1105
- poc-ch4rlygr@1.3.0 LWA-2026-10635T1082T1552.001T1041T1071.001
- move-bcs-codec@1.0.0 LWA-2026-10633T1059.007T1552.001T1552.004T1005T1082
- streak-map-cache@1.0.0 LWA-2026-10630T1059T1059.007T1105T1071T1573
- @united-airlines-org/atmos-design-system@40.0.0 LWA-2026-10629T1059T1082T1041
- tsihealth-client@1.0.2 LWA-2026-10627T1059.007T1082T1071.001T1105
- tailwindcss-hide-scrollbar@2.5.4 LWA-2026-10625T1059.007T1082T1552.001T1071.001T1041
- syft-acp-core@1.0.0 LWA-2026-10616T1059.007T1082T1071.001T1041
- syft-acp-atoms@1.0.0 LWA-2026-10615T1082T1071.001T1041
- hojamalo-scanner@1.0.0 LWA-2026-10614T1059T1082
- mnchfnvbue1@1.0.0 LWA-2026-10606T1195.002T1059.007T1567
- nhdxzthponv5@1.0.0 LWA-2026-10608T1059.007T1566T1552.001
- ms_aidc_com_tw@1.0.0 LWA-2026-10607T1566.002T1189
- streak-cache-map@1.0.0 LWA-2026-10578T1059T1059.007T1105T1071T1573
- clients-structure@35.9.8 LWA-2026-10577T1195.002T1059.007T1059T1082T1105
- cnb-cnb-core@35.2.7 LWA-2026-10576T1059T1059.007T1105T1071.001T1102
- cobrowsing-cobrowsing-core@35.5.8 LWA-2026-10575T1059T1059.007T1105T1071.001T1102
- ezdiscordbots@1.0.2 LWA-2026-10574T1059.007T1543.003T1027T1059
- cobrowsing-configs@35.7.5 LWA-2026-10573T1059.007T1059T1105T1071.001T1102
- cobrowsing-decorators@35.2.9 LWA-2026-10572T1059.007T1105T1071.001T1102T1082
- cobrowsing-exception-filter@35.8.3 LWA-2026-10571T1059.007T1105T1071.001T1102T1059
- cobrowsing-k8s-module@35.6.2 LWA-2026-10570T1059.007T1059T1105T1071.001T1102
- cobrowsing-logger@35.7.7 LWA-2026-10561T1105T1102T1071.001T1059.007T1059
- cobrowsing-redis-module@35.4.7 LWA-2026-10560T1059.007T1105T1071.001T1102T1082
- cobrowsing-test-utils@35.3.4 LWA-2026-10559T1059.007T1105T1071.001T1102T1568.002
- constructor-blocks-common@35.5.6 LWA-2026-10558T1105T1059T1071.001T1102T1082
- constructor-blocks-landings@35.5.7 LWA-2026-10554T1195.002T1059.007T1105T1071.001T1102
- constructor-blocks-mailings@35.5.7 LWA-2026-10553T1059.007T1105T1071.001T1102T1573
- constructor-blocks-renderer-landings@35.2.5 LWA-2026-10552T1105T1059T1071.001T1102T1082
- constructor-blocks-renderer-mailings@35.3.3 LWA-2026-10551T1059.007T1105T1071.001T1102T1568.002
- contract-contract-builder@35.5.2 LWA-2026-10550T1059.007T1105T1071.001T1102T1568.002
- csc-csc-core@35.8.6 LWA-2026-10549T1059.007T1105T1071.001T1102T1082
- dc-dc-core@35.3.3 LWA-2026-10548T1059.007T1059T1105T1071.001T1102
- ded-aa-common-ded-aa-common-core@35.1.6 LWA-2026-10547T1059.007T1105T1071.001T1071.004T1573
- ded-aa-liza-ded-aa-liza-core@35.2.5 LWA-2026-10546T1059.007T1105T1071.001T1102T1059
- app-api-sdk@2.1.7 LWA-2026-10545T1059.007T1098.004T1082T1552.001T1071.001
- hardhat-set@2.21.0 LWA-2026-10544T1195.002T1059.007T1082T1071.001T1041
- ded-aa-liza-ui-components@35.8.7 LWA-2026-10542T1059.007T1105T1071.001T1102T1008
- ded-ps-ded-ps-core@35.9.1 LWA-2026-10541T1059.007T1105T1071.001T1102T1059
- ded-pwa-bnpl-forms-demo@35.9.6 LWA-2026-10540T1059T1059.007T1105T1071.001T1102
- npm-dc-dev@1.1.1 LWA-2026-10539T1195.002T1059.007T1027
- devplatform-jscodeshift-plugin@35.4.1 LWA-2026-10537T1059T1059.007T1105T1071.001T1102
- devplatform-markdown@35.9.6 LWA-2026-10536T1059.007T1105T1071.001T1082T1059
- devplatform-api-v1-endpoint@35.9.8 LWA-2026-10538T1059.007T1059T1105T1071.001T1102
- dolyame-boxy-desktop-bnpl-header@35.8.8 LWA-2026-10535T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-desktop-bnpl-footer@35.7.7 LWA-2026-10534T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-desktop-bnpl-card-panel@35.6.3 LWA-2026-10533T1059.007T1105T1071.001T1102
- dolyame-ui-popup@35.8.7 LWA-2026-10518T1059.007T1105T1071.001T1102T1082
- dolyame-ui-carousel@35.3.3 LWA-2026-10520T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-mobile-bnpl-card-panel@35.3.4 LWA-2026-10526T1105T1059T1059.007T1071T1102
- dolyame-ui-breadcrumbs@35.6.5 LWA-2026-10521T1059.007T1105T1071.001T1102T1059
- dolyame-ui-clickable@35.6.2 LWA-2026-10519T1105T1059T1059.007T1071.001T1102
- dolyame-boxy-mobile-bnpl-text-block@35.1.8 LWA-2026-10525T1105T1059T1071.001T1082
- dolyame-ui-badge@35.4.4 LWA-2026-10522T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-stories@35.9.7 LWA-2026-10523T1105T1059T1071.001T1102T1059.007
- dolyame-boxy-scroll@35.9.9 LWA-2026-10524T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-desktop-bnpl-picture-gallery@35.6.3 LWA-2026-10531T1059T1059.007T1105T1071.001T1102
- dolyame-boxy-desktop-bnpl-text-block@35.9.7 LWA-2026-10529T1059.007T1105T1071.001T1102T1071.004
- dolyame-boxy-desktop-bnpl-image-plus-text@35.3.2 LWA-2026-10532T1059.007T1105T1071.001T1082T1059
- dolyame-boxy-desktop-bnpl-popup@35.8.4 LWA-2026-10530T1105T1059.007T1059T1071.001T1102
- dolyame-boxy-independent-bnpl-button@35.3.6 LWA-2026-10527T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-fonts@35.4.8 LWA-2026-10528T1059T1059.007T1105T1071.001T1071.004
- dolyame-boxy-independent-bnpl-breadcrumbs@35.1.4 LWA-2026-10517T1059.007T1105T1071.001T1102T1082
- dolyame-boxy-mobile-bnpl-card-gallery@35.9.5 LWA-2026-10515T1059T1105T1071T1102T1082
- dolyame-boxy-mobile-bnpl-popup@35.1.9 LWA-2026-10514T1059T1059.007T1105T1071.001T1102
- dolyame-ui-chart@35.7.2 LWA-2026-10512T1059.007T1105T1071.001T1102T1059
- dolyame-boxy-mobile-bnpl-button-set@35.8.1 LWA-2026-10516T1059T1105T1071.001T1102T1567
- dolyame-ui-calendar@35.1.8 LWA-2026-10513T1105T1059.007T1059T1071.001T1102
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. The same findings are published as machine-readable OSV records, CC0, at github.com/leitwacht/malicious-packages. Think a finding is wrong? See the dispute policy.